OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-107826 · Microsoft / collected KEV context

EUVD-2026-95925

GHSA-6gcq-wc29-5xf2

GO-2026-6693

cve-program · CVE-2026-107826

• https://github.com/corazawaf/coraza/security/advisories/GHSA-6gcq-wc29-5xf2
• https://github.com/corazawaf/coraza/commit/814e1898e083d2ff2ceb644382d0da17e930f93f
• https://github.com/corazawaf/coraza/releases/tag/v3.8.1

euvd · EUVD-2026-95925

• https://github.com/corazawaf/coraza/security/advisories/GHSA-6gcq-wc29-5xf2
• https://github.com/corazawaf/coraza/commit/814e1898e083d2ff2ceb644382d0da17e930f93f
• https://github.com/corazawaf/coraza/releases/tag/v3.8.1

nvd · CVE-2026-107826

• https://github.com/corazawaf/coraza/commit/814e1898e083d2ff2ceb644382d0da17e930f93f
• https://github.com/corazawaf/coraza/releases/tag/v3.8.1
• https://github.com/corazawaf/coraza/security/advisories/GHSA-6gcq-wc29-5xf2

osv · GHSA-6gcq-wc29-5xf2

• https://github.com/corazawaf/coraza/security/advisories/GHSA-6gcq-wc29-5xf2
• https://github.com/corazawaf/coraza/commit/814e1898e083d2ff2ceb644382d0da17e930f93f
• https://github.com/corazawaf/coraza
• https://github.com/corazawaf/coraza/releases/tag/v3.8.1

osv · GO-2026-6693

• https://github.com/corazawaf/coraza/security/advisories/GHSA-6gcq-wc29-5xf2
• https://github.com/corazawaf/coraza/commit/814e1898e083d2ff2ceb644382d0da17e930f93f
• https://github.com/corazawaf/coraza/releases/tag/v3.8.1

No related operational record is retained in the current change model.